A comprehensive internet privacy and data breach protection bill introduced by California Senators Bill Dodd, D-Napa, Bob Hertzberg, D-Van Nuys and Assemblymember Ed Chau, D-Monterey Park, passed the Senate and Assembly on June 28 and was signed into law by Gov. Jerry Brown.
Adoption of the California Consumer Privacy Act of 2018, or AB 375 – which takes effect on January 1, 2020 – was followed by the withdrawal of a ballot measure seeking the same protections that would have cost California taxpayers millions of dollars.
“Once again California is taking the lead in protecting consumers and holding bad actors accountable,” Sen. Dodd said. “My hope is other states will follow, ensuring privacy and safeguarding personal information in a way the federal government has so far been unwilling to do.”
Recent data breaches that affected millions – those experienced by Target, Equifax, Cambridge Analytica, and many more – have raised concerns from internet users around the world. The continued prevalence of such occurrences and uncertainty about what data is being collected has drawn the ire of consumer and public interest groups.
With this in mind, Senators Dodd and Hertzberg and Assemblymember Chau introduced AB 375 to expand the rights of consumers to know what data is being collected about them online, and even to delete it. The bill would also empower consumers to decline the sale of their information and report violations, which must then be addressed by the violator or risk civil action.
Specifically, AB 375 will:
• Grant a consumer a right to request a business to disclose the personal information it collects about the consumer, the sources from which the information is collected, the business purposes for collecting or selling the information, and the parties with which the information is shared;
• Grant a consumer the right to request deletion of personal information;
• Grant a consumer a right to request that a business that sells the consumer’s personal information, disclose the categories of information that it collects and the identity of the parties to which the information was disclosed;
• Authorize a consumer to opt out of the sale of personal information by a business and would prohibit the business from discriminating against the consumer for exercising this right, including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services;
• Authorize businesses to offer financial incentives for collection of personal information;
• Prohibit a business from selling personal information of a consumer under 16 years of age;
• Prescribe various definitions for its purposes and would define “personal information” with reference to a broad list of characteristics and behaviors, personal and commercial, as well as inferences drawn from this information;
• Prohibit the provisions described above from restricting the ability of the business to comply with federal, state, or local laws.
“Today, California took a historic step in enacting legislation to protect children and consumers by giving them control of their own personal data,” said Assemblymember Chau. “Consumers should have a right to choose how their personal information is collected and used by businesses. It is your data, your privacy, your choice.”